In the world of information security, well-defined security programs are the forests, and regulations like HIPAA, SoX and PCI are the trees. And too many healthcare organizations mistake the forest for the trees.

By way of analogy, one of the benefits of Social Security is SSI or Supplemental Security Income. The operative word is supplemental. Social Security is meant to augment your retirement, not be the main income source for your retirement. HIPAA i...